RE: SARE Update: 90_2tld.cf

2008-11-03 Thread Martin.Hepworth
Don't see this on a web site any where..the URL works but there's mention/documentation of if I can find. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Yet Another Ninja [mailto:[EMAIL PROTECTED] > Sent: 01 November 20

RE: exim spamassassin AFTER SMTP

2008-10-22 Thread Martin.Hepworth
Hi Put in an ACL for local machines so that you don't run SA for these people. Either that or if users are remote (ie you're an ISP) do authententication then use that for the ACL check. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Mess

RE: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-22 Thread Martin.Hepworth
Dave I got mine in seconds this morning. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Dave Koontz [mailto:[EMAIL PROTECTED] > Sent: 22 September 2008 15:30 > To: Justin Piszcz > Cc: users@spamassassin.apache.org > Sub

RE: Trobles with spamassassin

2008-09-19 Thread Martin.Hepworth
Hi You'll probably get a lot of this, but a lot the software you mention is really really old, and I'm surprised you're clamav is indeed getting it's regular updates. Also a lot of people will recommend NOT using a fast moving linux distribution like Fedora as server. Once you've upgraded spa

RE: Spamassassin Letting a Lot of Spams Through

2008-09-14 Thread Martin.Hepworth
Hi /usr/share/spamassassin - contains version release time rules, always used unless next dir exists. /var/lib/spamassassin// - contains 'sa-update'ed rules to bring release time rules upto date without needing a full version release /etc/mail/spamassassin - contains site wide rules and set

RE: Skip scanning for large mails

2008-09-13 Thread Martin.Hepworth
Sorry, the feature of not SA scanning if the message is 'large'. -- martin -Original Message- From: mouss <[EMAIL PROTECTED]> Sent: Saturday, September 13, 2008 8:25 PM Cc: users@spamassassin.apache.org Subject: Re: Skip scanning for large mails Martin.Hepworth wrote:

RE: Skip scanning for large mails

2008-09-13 Thread Martin.Hepworth
Depends on you call SA.. Mailscanner for one has this feature. martin -Original Message- From: mouss <[EMAIL PROTECTED]> Sent: Saturday, September 13, 2008 6:42 PM Cc: users@spamassassin.apache.org Subject: Re: Skip scanning for large mails RobertH wrote: >> From: mouss > >> >> 1MB is p

RE: MagicSpam

2008-09-11 Thread Martin.Hepworth
I find i have to run botnet rules individually, not as the big meta rule. See the doc in the tar ball for how to. -- martin -Original Message- From: Jesse Stroik <[EMAIL PROTECTED]> Sent: Thursday, September 11, 2008 10:03 PM To: [EMAIL PROTECTED] Cc: users@spamassassin.apache.org Subjec

RE: MagicSpam

2008-09-11 Thread Martin.Hepworth
Rob Can't say i have, but SA does need someone with a little expertise and a clue (tm) to get it going well. After that it takes very little extra work apart from upgrading every so often and running sa-update every week or so. -- martin -Original Message- From: <[EMAIL PROTECTED]> S

RE: SpamAssassin not always works....

2008-09-08 Thread Martin.Hepworth
Hi normally this is a timeout issue, check your dns (local caching dns on the spamd server helps alot) andake you are not running all rbls as this can take along time. -- martin -Original Message- From: ersteller <[EMAIL PROTECTED]> Sent: Monday, September 08, 2008 6:35 PM To: users@sp

RE: sa-update no new rules ?

2008-09-02 Thread Martin.Hepworth
David 3.1.8 is fairly old, doesn't surprise me there's no updates. -- martin -Original Message- From: David Carvalho <[EMAIL PROTECTED]> Sent: Tuesday, September 02, 2008 6:13 PM To: users@spamassassin.apache.org Subject: sa-update no new rules ? Hi ! I'm using spamassassin 3.1.8 on a

RE: Handy script for generating /etc/resolv.conf

2008-08-28 Thread Martin.Hepworth
Marc So what happens if you run a local nameserver in caching mode? You may find this reduces the DNS related query time (and for that matter overall SA processing) dramitcally). -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message-

RE: Sa-learn

2008-08-26 Thread Martin.Hepworth
Theres quite a few docs about sa-learning and imap email boxes. Doesn't matter whetr it's remote or local in this scenario. -- martin -Original Message- From: Thiago Henrique <[EMAIL PROTECTED]> Sent: Tuesday, August 26, 2008 5:57 PM To: users@spamassassin.apache.org Subject: Sa-learn

RE: Updating rules with old version of spamassassin

2008-08-26 Thread Martin.Hepworth
Patrick Yes RDJ will still work, but only for the ones you've enabled. There's been very liitle update on the standard RDJ ruleset for months now. So don't expect to see much updating. Sa-update is the way to go for more modern versiosn, this will also keep the core rules updated too. -- Mar

RE: What is current version of Botnet plugin?

2008-08-05 Thread Martin.Hepworth
Steve Home page is// http://people.ucsc.edu/~jrudd/spamassassin/ Latest is 0.8 -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Steven Stern [mailto:[EMAIL PROTECTED] > Sent: 04 August 2008 21:13 > To: users@spamassass

RE: Memory Leak?

2008-07-25 Thread Martin.Hepworth
Ron I'd check what RBL's and URI-RBL's you are running. If you haven't turned any of them then you're running them all - which can lead to very long processing times. Choose one or two you want by looking through the 20_dnsbl_tests.cf file. And give then rest a zero score in local.cf Running

RE: How to configure spamassassin to reject mails having invalid return path

2008-07-23 Thread Martin.Hepworth
Hi That's because you've put 'from [EMAIL PROTECTED]' in the whitelist. This is a bad idea as you've found out, as spammers almost always fake the from address. I find it's best not to call SA when the email if from trusted IP-Addresses not email addresses, esp for my local domain. Depends on

RE: Rules in local.cf are not read?

2008-06-20 Thread Martin.Hepworth
Simone This is more a mailscanner issue - try asking there.. The spamassassin is timing out. What RBL's are you running in spamassassin? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Simone Morandini [mailto:[EMAIL PR

RE: , stretch test for SA

2008-06-20 Thread Martin.Hepworth
Yeah the whay you get a phone call once a month to the help desk when a single piece of spam ends up in users inbox ;-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: NGSS [mailto:[EMAIL PROTECTED] > Sent: 20 June 2008

RE: Moving ham/spam from Exchange folders to sa-learn?

2008-06-19 Thread Martin.Hepworth
Henry Make sure the spam/ham folders are imap folders. Make sure they drag the messages into that folder and not email them as it'll muck up the headers otherwise. Then grab a perl script (heck here's one below) to get messages from those folders and place into the bayes. Make sure you're run

RE: AWL aging?

2008-05-31 Thread Martin.Hepworth
Greg Never found awl much good in a multi-user setup. Seems very variable - works For some, not for others. I get wayoo many false negatives with it as the spammers use the same 'from' quite a few times, so the address makes it io the awl db. Ymmv as they say. -- martin -Original Messag

RE: Splitting cc:'s

2008-05-22 Thread Martin.Hepworth
You can do this with an "incestuous" call to exim. Make this your first router: split: driver = accept domains = the.domains.you.want.to.do.this.for condition = ${if eq {$received_protocol}{split}{no}{yes}} transport = send_to_self no_verify Add this transport: send_to_self: dr

RE: Spamassassin hang on bayes

2008-03-20 Thread Martin.Hepworth
Paolo Upgrade to latest 3.2.4, run sa-update and see if this makes any difference. There where a couple of nasty buglets in 3.2.3 that could slow the whole the thing down. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From

pyzor finally dead?

2008-02-13 Thread Martin.Hepworth
All We've been using the following pyzor server.. 82.94.255.100:24441 For many years now as the 'official' one seemed not to update. Now this this seems to be dead as well (well people on the MailScanner IRC channel also report no activity from this). Any news or good alternates? -- Martin H

RE: Upgrade to 3.2.3 introduced severe slowness

2007-12-21 Thread Martin.Hepworth
Thomas Check you've done an sa-update after you installed 3.2.3. There's a nasty bug with completewhois lookups in the default 3.2.3. Running sa-update turns off those rules. If you want those rules working then install the patch found in bug id 5589. But easiest 'fix' is run sa-update ;-) --

RE: How to catch these?

2007-11-28 Thread Martin.Hepworth
gt; Subject: RE: How to catch these? > > Martin.Hepworth wrote: > > > 2.3 MANGLED_VIDEO BODY: mangled video(s) > > > > The MANGLED_VIDEO is from one of Jennifier's rules on > > http://www.rulesemporium.com/other-rules.htm - guess which one ;-)

RE: How to catch these?

2007-11-28 Thread Martin.Hepworth
Matthias My system on 3.1.8 scores this.. Content analysis details: (7.1 points, 5.0 required) pts rule name description -- -- 0.5 HELO_EQ_LOCALHOST HELO_EQ_LOCALHOST 0.8 UNDISC_RECIPS Valid-

RE: HAM in Outlook to SA Learn

2007-11-20 Thread Martin.Hepworth
42300 > -Original Message- > From: Jason Holbrook [mailto:[EMAIL PROTECTED] > Sent: 20 November 2007 16:16 > To: Jackson, Jeff; Martin.Hepworth; [EMAIL PROTECTED]; > users@spamassassin.apache.org > Cc: Josh Sindy > Subject: RE: HAM in Outlook to SA Learn > > Jeff: > Than

RE: HAM in Outlook to SA Learn

2007-11-20 Thread Martin.Hepworth
Jason Yes - very easily. You need a spam and ham folder on the ms-exch box that can be accessed via imap. Then there are many perl scripts etc you can run on the mailscanner gateway machine that will grab the email and feed it into sa-learn. NB users need to move not copy emails for training o

Re: SA date on 2 tmp file 1970

2007-11-04 Thread Martin.Hepworth
Mark you mean 3.2.3 rather than 2.3.2??? ;-) -- martin On Sun, 4 Nov 2007 09:49:04 - "Obantec Support" <[EMAIL PROTECTED]> wrote: Hi SA 2.3.2 on FC3 time and date on server is correct but during routine checks i found to files in /tmp .spamassassin12592Gefj53tmp .spamassassin12592PV3

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
Justin Well it's there, just doesn't seem to work ! -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: 19 October 2007 10:55 > To: Martin.Hepworth

RE: spamd hangs at 100% cpu

2007-10-19 Thread Martin.Hepworth
Peter Get the latest ruleset for SA using sa-update, this works around an issue with whois lookups. Only run a few RBL's - you're running them all and this will take some time. Running a local caching nameserver on the box will help as well. -- Martin Hepworth Snr Systems Administrator Solid

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: UxBoD [mailto:[EMAIL PROTECTED] > Sent: 19 October 2007 09:14 > To: Martin.Hepworth > Cc: [EMAIL PROTECTED] > Subject: Re: MP3 Spam > > Hmmm, hit okay here Martin :- &

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
http://www.solidstatelogic.com/mp3-spam.txt -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: UxBoD [mailto:[EMAIL PROTECTED] > Sent: 19 October 2007 09:01 > To: Martin.Hepworth > Cc: [EMAIL PROTECTED] >

RE: MP3 Spam

2007-10-19 Thread Martin.Hepworth
Just tried this on an example we had overnight and it's didn't hit ;-( -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: UxBoD [mailto:[EMAIL PROTECTED] > Sent: 19 October 2007 08:45 > To: Justin Mason > Cc: users@spamassa

RE: Question about total effective of spamassassin

2007-10-16 Thread Martin.Hepworth
My SA setup is way better than that on it's own, but I have lots of 3rd parts rules in the mix.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Kent Borg [mailto:[EMAIL PROTECTED] > Sent: 16 October 2007 15:46 > To: us

RE: Low resource rules

2007-10-01 Thread Martin.Hepworth
Also rejecting non-existant recipients straight away helps a lot - I'm dropping over 65% of my traffic this way.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Adam Wilbraham [mailto:[EMAIL PROTECTED] > Sent: 01 Octobe

RE: Bayes database corrupted

2007-09-18 Thread Martin.Hepworth
Hi Check the permissions on the file for that file/directory structure and user. If you haven't got a backup then there are some nice starter DB's to get you going at wwwl.fsl.com/support. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Mes

RE: my collegue id received as spam

2007-09-04 Thread Martin.Hepworth
Hi -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Sg [mailto:[EMAIL PROTECTED] > Sent: 04 September 2007 10:22 > To: Martin.Hepworth > Subject: Re: my collegue id received as spam > Hi Still not w

RE: my collegue id received as spam

2007-09-04 Thread Martin.Hepworth
Hi I mean why does SA think this is spam? What rules are firing within spamassassin. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Sg [mailto:[EMAIL PROTECTED] > Sent: 04 September 2007 08:38 > To: Mar

RE: my collegue id received as spam

2007-09-04 Thread Martin.Hepworth
Sg Can you please show us what rules fired so we can advise. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Sg [mailto:[EMAIL PROTECTED] > Sent: 04 September 2007 07:06 > To: users@spamassassin.apache.org > Subject: my

RE: integration with domino....linux

2007-08-28 Thread Martin.Hepworth
Richard You could setup a gateway with either MailScanner or Amavis-new -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: richard venne [mailto:[EMAIL PROTECTED] > Sent: 28 August 2007 14:32 > Cc: users@spamassassin.apach

RE: BOTNET Exceptions for Today

2007-08-22 Thread Martin.Hepworth
> -Original Message- > From: news [mailto:[EMAIL PROTECTED] On Behalf Of René Berber > Sent: 22 August 2007 07:42 > To: users@spamassassin.apache.org > Subject: Re: BOTNET Exceptions for Today > > John Rudd wrote: > > > René Berber wrote: > >> Here's a good example of why Botnet's default

RE: Adding new header to SA

2007-08-20 Thread Martin.Hepworth
Yossim More appropriate to the mailscanner list, but as part of the spam and/or high spam action add in the new header. Have a look at the comments in the MailScanner.conf file above these settings. If you're still stuck ask on the mailscanner list. -- Martin Hepworth Snr Systems Administrator

RE: v3.2.3 isn't recognizing local.cf custom rules

2007-08-20 Thread Martin.Hepworth
Hi When you do the --lint -D etc make sure you're doing this as the user Mailscanner runs as (v important if running non-sendmail as the MTA). Also try "Mailcanner --debug --debug-sa" -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message

RE: Rule for PDF and eCard Spam Needed

2007-08-16 Thread Martin.Hepworth
Ecard spams get scored as follows. 5.40BAYES_99Bayesian spam probability is 99 to 100% 4.00DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/) 0.77DIGEST_MULTIPLE Message hits more than one network digest check 0.90HOST_EQ_RO 4.00NORMAL_HTTP_TO_IP

RE: lottery spam as .doc files

2007-08-09 Thread Martin.Hepworth
44 (0)1865 842300 > -Original Message- > From: Martin.Hepworth [mailto:[EMAIL PROTECTED] > Sent: 08 August 2007 16:50 > To: [EMAIL PROTECTED] > Subject: lottery spam as .doc files > > > > Heads up, the pdf stock spam has morphed to ms-word files for lottery > w

RE: FW: AWARD NOTIFICATION:

2007-08-09 Thread Martin.Hepworth
n [mailto:[EMAIL PROTECTED] > Sent: 08 August 2007 23:33 > To: Martin.Hepworth > Cc: users@spamassassin.apache.org > Subject: Re: FW: AWARD NOTIFICATION: > > On Wed, 8 Aug 2007, Martin.Hepworth wrote: > > > As requested... > > Sending a 700KB attachment to a popular ma

RE: lottery spam as .doc files

2007-08-08 Thread Martin.Hepworth
It's huge 660KB for the attachments... I'll dig out a place to drop it to.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Banyan He [mailto:[EMAIL PROTECTED] > Sent: 08 August 2007 17:12 > To

lottery spam as .doc files

2007-08-08 Thread Martin.Hepworth
Heads up, the pdf stock spam has morphed to ms-word files for lottery winnings.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ** Confidentiality : This e-mail and any attachments ar

RE: spamassassin gets stucked in

2007-08-08 Thread Martin.Hepworth
Hi Turn off the RBL's (or only use a couple). DNS checks can take along time. Yes SA is very memory hungry.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Néher Márton [mailto:[EMAIL PROTECTED] > Sent: 08 August

RE: spamassassin gets stucked in

2007-08-03 Thread Martin.Hepworth
Hi I'd start by only using a couple of RBL's (give the others zero scores in local.cf). I'd also check how you're calling SA? I'd not call SA for large emails (above 100k) so save a lot of time. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Orig

RE: RDJ 404's

2007-07-26 Thread Martin.Hepworth
Maybe obsolete for sare rules (due to ddos issues etc), but its very handy for other peoples rulesets you want to keep up-to date.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTEC

RE: isolated W

2007-07-06 Thread Martin.Hepworth
t return these hits. > > Thanks, > Donald > > -Original Message- > From: Martin.Hepworth [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 05, 2007 10:55 AM > To: Dawson, Donald; users@spamassassin.apache.org > Subject: RE: isolated W > > > Donald > >

RE: isolated W

2007-07-05 Thread Martin.Hepworth
Donald Just got in something very similar and it scored thus.. X-Solid-State-Logic-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=6.311, required 5, BAYES_50 0.00, BOTNET 5.00, FH_HOST_EQ_D_D_D_D 0.67, HOST_MISMATCH_COM 0.31, IP_NOT_FRIENDLY 0.33) -- Martin

RE: isolated W

2007-07-05 Thread Martin.Hepworth
Donald My analysis (SA 3.1.8) Content analysis details: (10.9 points, 5.0 required) pts rule name description -- -- 1.5 FH_RELAY_NODNS We could not determine your Reverse DNS 2.5 MISSING_HB_SEP

FW: dns problem - spamassassin bug?

2007-06-27 Thread Martin.Hepworth
Alex In order to work around the Net::DNS issues Theo mentioned it's best to run a local caching nameserver on the server itself. That way resolv.onf contains a single nameserver line which solves the problem. As an aside this also increases the Spamassassin DNS speed incredibly. I'm not kiddin

RE: 3.2.1 install failure

2007-06-13 Thread Martin.Hepworth
Chris Don't compile as root and you'll be fine - already been raised as a bug. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Chris [mailto:[EMAIL PROTECTED] > Sent: 13 June 2007 15:46 > To: users@spamassassin.apache.or

RE: www.uribl.com

2007-06-06 Thread Martin.Hepworth
Ken Web site may be having trouble but the BL's are still responding -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Ken A [mailto:[EMAIL PROTECTED] > Sent: 06 June 2007 17:38 > To: users@spamassassin.apache.org > Subjec

RE: Upgrade to 3.2.0 failed => Malformed UTF-8 character @Bayes.pm line 362

2007-05-16 Thread Martin.Hepworth
Hi Common problem with perl < 5.8.8 and the SARE rules. In Messages.pm in the spamassassin perl library add a line like the following after "use warnings;"... "use bytes;" -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message-

RE: SpamAssassin timed out and was killed

2007-05-16 Thread Martin.Hepworth
Hi You sure about that MailScanner versionm or is it a typo? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: leiw [mailto:[EMAIL PROTECTED] > Sent: 16 May 2007 03:45 > To: users@spamassassin.apache.org > Subject: SpamAss

RE: cannot install it on BSD

2007-04-30 Thread Martin.Hepworth
Any more details - which version of FreeBSD, how are you trying to install it (ports/cpan/source???) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Mailing List [mailto:[EMAIL PROTECTED] > Sent: 28 April 2007 18:00 > To:

RE: PNG vurnability

2007-04-23 Thread Martin.Hepworth
Rob Might be worthwhile moving this to the MailScanner list as it's nothing to do with SA per sa. But what version of MailScanner are you running, as I can't see anything that would block png files by default. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300

RE: Low Scoring MC/MS scam spam

2007-04-12 Thread Martin.Hepworth
Scores well on my system... Content analysis details: (14.0 points, 5.0 required) pts rule name description -- -- -0.0 SPF_PASS SPF: sender matches SPF record 1.3 NA_DOLLARS BODY:

RE: Messages receiving High Score but still getting through

2007-04-02 Thread Martin.Hepworth
Guys Looks like a MailScanner config issue. May I suggest we take this over the MailScannre list and we'll help there.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: 02 A

RE: Mail Appliances?

2007-02-26 Thread Martin.Hepworth
Paul Have a look at the DefenderMX range (and something new due any day now), from www.fsl.com. Basically is a commercial version of MailScanner (with added stuff on it). -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From:

RE: New "nigerian" getting through almost clean

2007-02-22 Thread Martin.Hepworth
Andy And this one Content analysis details: (8.1 points, 5.0 required) pts rule name description -- -- -0.0 SPF_PASS SPF: sender matches SPF record 0.6 J_CHICKENPOX_71BODY: {7}Letter -

RE: Stock Spam Getting Through

2007-02-22 Thread Martin.Hepworth
Andy This scores 7.1 for me.. Content analysis details: (7.1 points, 5.0 required) pts rule name description -- -- 1.0 L_DRUGS12 L_DRUGS12 0.1 FORGED_RCVD_HELO Received: contains a forg

RE: How to Scan just incoming not outcoming emails?

2007-02-15 Thread Martin.Hepworth
Ask on the MailScanner list (if not already) and we'll show you how to attach a ruleset to the correct parameter in MailScanner.conf -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: [mailto:[EMAIL PROTECTED] > Sent: 1

RE: False Primary MX Record = MORE spam?

2007-02-08 Thread Martin.Hepworth
Ben I found A LOT of spam tries secondary MX first as a way to circumvent spam filters.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Ben Hanson [mailto:[EMAIL PROTECTED] > Sent: 08 February 2007 13:55 > To: users@spa

RE: lapses in basic tests?

2007-02-07 Thread Martin.Hepworth
Todd Mangled.cf from www.rulesemporium.com/other-rules.htm works well for me -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Todd Adamson [mailto:[EMAIL PROTECTED] > Sent: 07 February 2007 14:48 > To: users@spamassassin.a

RE: rules_du_jour site down?

2007-02-05 Thread Martin.Hepworth
Gene Yup same for meI've just emailed Chris about it.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Gene Heskett [mailto:[EMAIL PROTECTED] > Sent: 05 February 2007 14:14 > To: users@spamassassin.apache.org > Subje

RE: Fake spam-status ?

2007-02-05 Thread Martin.Hepworth
Jarek Looks like the spammers are trying to fool you into not checking email based on this header - ie it's already been scanned so I'll let it through.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Jarek [mailto:[EMA

RE: Spam making it through

2007-02-05 Thread Martin.Hepworth
Simon I use this rule to find URL's with illegal characters in it.. # 2007-01-24 new rules (adapted from Henrik Krohns # <[EMAIL PROTECTED]> on SA list) # http:// [user [:password] @] # + <1 illegal char> + # + ( or / or ? or :) uri local_OBFUDOM /https?:\/\/([a-z0-9._\-]{1

pill spam...

2007-01-29 Thread Martin.Hepworth
Hi Getting email with the following style of obsfucation in it.. Viaz_gra $1, 80 Ciaz_lis $3, 00 Leviz_tra $3, 35 only following rules.. score=6.17 5 required 5.40BAYES_99Bayesian spam probability is 99 to 100% 0.14FORGED_RCVD_HELOReceived: contains a forged HELO

RE: market buy with image

2007-01-23 Thread Martin.Hepworth
Hi The sare and fred rules from www.rulesemporium.com are useful here. Also DCC pyzor and razor2 can help. Also make sure you've sa-updated the latest 3.1.7 core rules as these have some tuning to help.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 >

RE: Runing out of Disk Space

2007-01-22 Thread Martin.Hepworth
Hmm that looks very wrong.. Should be /var/lib if not blank nowaways.. I wonder if you're confusing the User State dir with the spamassassin cache dir in MailScanner.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: The

RE: Runing out of Disk Space

2007-01-19 Thread Martin.Hepworth
> you'll have to use the cron method.. > > > > -- > > Martin Hepworth > > Snr Systems Administrator > > Solid State Logic > > Tel: +44 (0)1865 842300 > > > >> -Original Message- > >> From: Nigel Robson [mailto:[EMAI

RE: Runing out of Disk Space

2007-01-19 Thread Martin.Hepworth
t; > >> Martin Hepworth-3 wrote: > >> > > >> > Nigel > >> > > >> > List is best.. > >> > > >> > Commented out is fine - as in that's what I've got.. ;-) > >> > > >> > If you're oth

RE: Runing out of Disk Space

2007-01-19 Thread Martin.Hepworth
; -Original Message- > From: Nigel Robson [mailto:[EMAIL PROTECTED] > Sent: 19 January 2007 09:54 > To: Martin.Hepworth > Subject: RE: Runing out of Disk Space > > Hi there Martin. I'm not sure if I am meant to reply back to you or the > forum? > > Anyway,

RE: Runing out of Disk Space

2007-01-19 Thread Martin.Hepworth
Nigel Ideally this would be on the mailscanner list... There's a couple of ways MailScanner can expire the bayes tokens down, and which one works for you seems to be hit and miss from my experience.. 1st method is to use the 'internal' MailScanner method. In MailScanner.conf, make sure Rebuild

RE: URIBL

2007-01-17 Thread Martin.Hepworth
Jon Dcc, pyzor (using a working server) and razor are useful.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Jon Bjorn Njalsson [mailto:[EMAIL PROTECTED] > Sent: 17 January 2007 14:47 > To: Martin.Hepworth

RE: URIBL

2007-01-17 Thread Martin.Hepworth
Jon Yes this functionality has been built in since SA version 3.0 (and via an additional 'plugin' since 2.6.?4?). Make sure you are using network tests, Net::DNS perl module is installed and the URI-RBL plugin is enabled in the *.pre files which are located in the same place as local.cf (normally

RE: Avoiding Bayes Poison

2007-01-11 Thread Martin.Hepworth
've got the URIRBL plugin installed and the Net::DNS perl module.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Clay Davis [mailto:[EMAIL PROTECTED] > Sent: 11 January 2007 16:14 > To: Martin.Hepw

RE: Avoiding Bayes Poison

2007-01-11 Thread Martin.Hepworth
44 (0)1865 842300 > -Original Message- > From: Clay Davis [mailto:[EMAIL PROTECTED] > Sent: 11 January 2007 15:44 > To: Martin.Hepworth; users@spamassassin.apache.org > Subject: RE: Avoiding Bayes Poison > > No its all kinda like the attached. > C > > >&

RE: Avoiding Bayes Poison

2007-01-11 Thread Martin.Hepworth
Clay This spam hasn't got a nice image in it with the actual spam message in it has it?? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Message- > From: Clay Davis [mailto:[EMAIL PROTECTED] > Sent: 11 January 2007 14:58 > To: users@spam